iframe-proxy: serve error page on HTML body truncation

When an upstream HTML response exceeds HTML_BODY_LIMIT, collectBody
previously destroyed the stream and handed back the partial bytes, which
were then instrumented and served as a truncated document. Serve a clear
"exceeded HTML_BODY_LIMIT of N MB" error page instead, so we never ship
half a page (where the shim may have landed past the cutoff).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dormouse-bot

vscode-ext/src/iframe-proxy-host.ts

@@ -198,13 +198,19 @@ function handleRequest(grant: Grant, req: http.IncomingMessage, res: http.Server
       passThrough(grant, upstreamRes, res);
       return;
     }
-    collectBody(upstreamRes, (body) => {
+    collectBody(upstreamRes, (body, truncated) => {
       // A remote that forbids embedding is never force-framed — serve an
       // actionable page that points at `dor ab` instead of a blank pane.
       if (!grant.isLoopback && refusesFraming(upstreamRes.headers)) {
         serveErrorPage(res, frameRefusedPage(grant.upstream));
         return;
       }
+      // An over-limit body can't be safely instrumented (the shim may land past
+      // the cutoff, and serving half a document is worse than an honest error).
+      if (truncated) {
+        serveErrorPage(res, bodyTooLargePage(grant.upstream));
+        return;
+      }
       const html = instrumentHtml(body);
       const outHeaders = sanitizeResponseHeaders(grant, upstreamRes.headers);
       outHeaders['content-type'] = 'text/html; charset=utf-8';
@@ -225,18 +231,20 @@ function passThrough(grant: Grant, upstreamRes: http.IncomingMessage, res: http.
   upstreamRes.pipe(res);
 }
 
-function collectBody(stream: http.IncomingMessage, done: (body: string) => void): void {
+function collectBody(stream: http.IncomingMessage, done: (body: string, truncated: boolean) => void): void {
   const chunks: Buffer[] = [];
   let size = 0;
+  let truncated = false;
   stream.on('data', (chunk: Buffer) => {
     size += chunk.length;
     if (size > HTML_BODY_LIMIT) {
+      truncated = true;
       stream.destroy();
       return;
     }
     chunks.push(chunk);
   });
-  const complete = () => done(Buffer.concat(chunks).toString('utf8'));
+  const complete = () => done(Buffer.concat(chunks).toString('utf8'), truncated);
   stream.on('end', complete);
   stream.on('error', complete);
 }
@@ -367,6 +375,15 @@ function frameRefusedPage(upstream: URL): ErrorPage {
   };
 }
 
+function bodyTooLargePage(upstream: URL): ErrorPage {
+  const limit = `${Math.round(HTML_BODY_LIMIT / (1024 * 1024))} MB`;
+  return {
+    title: `${upstream.host} sent too much HTML`,
+    message: `The HTML response from ${upstream.href} exceeded HTML_BODY_LIMIT of ${limit}, so it couldn’t be instrumented and shown in an iframe surface.`,
+    hint: `dor ab open ${upstream.href}`,
+  };
+}
+
 function unreachablePage(upstream: URL, detail: string): ErrorPage {
   return {
     title: `Nothing responding at ${upstream.host}`,